The POODLE bug is a new bug discovered by Google in the SSLv3 protocol. The fix is easy, disable support for SSLv3.

See the google security blog for more info on the bug: http://googleonlinesecurity.blogspot.nl/2014/10/this-poodle-bites-exploiting-ssl-30.html.

 

Fix POODLE

To fix the bug, disable SSLv3 and use a secure cipherlist. SSL v2 is also insecure, so we need to disable it too.

So edit the Apache config file and add following

SSLProtocol All -SSLv2 -SSLv3

All is a shortcut for +SSLv2 +SSLv3 +TLSv1 or – when using OpenSSL 1.0.1 and later – +SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, respectively. The above line enables everything except SSLv2 and SSLv3

And then restart the Apache service

service httpd restart

 

cPanel/WHM

If you have a cPanel server, you should not edit Apache configurations directly, instead you can do this from WHM.

 

Apache-Configuration-WHM

 

1. Visit your server’s WHM Panel ( https://<yourserversip>:2087 )
2. Navigate to the Apache Configuration Panel of WHM.
3. Scroll down to the ‘Include Editor’ Section of the Apache Configuration.
4. Click ‘Pre Main Include’, which will jump to the corresponding section. Via the drop-down selector, choose ‘All Versions’.
5. An empty dialogue box will appear allowing you to input the needed configuration updates. In this box, copy and paste the following:

SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On

 

For Nginx

If you’re running an NGINX web server that currently uses SSLv3, you need to edit the NGINX configuration (nginx.conf). You will need to add the following line to your server directive:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

Then restart the nginx service

service nginx restart

For LiteSpeed:

Update to LiteSpeed version 4.2.18.

For more information about Litespeed & POODLE: http://www.litespeedtech.com/support/forum/threads/lsws-4-2-18-released-%E2%80%94-addresses-poodle-sslv3-vulnerability.9948/

Note about Mail Servers:

The POODLE attack requires the client to retry connecting several times in order to downgrade to SSLv3, and typically only browsers will do this. Mail Clients are not as susceptible to POODLE. However, users who want better security should switch to Dovecot until we upgrade Courier to a newer version.

For cpsrvd:

1. Go to WHM => Service Configuration => cPanel Web Services Configuration
2. Make sure that the “TLS/SSL Protocols” field contains “SSLv23:!SSLv2:!SSLv3”.
3. Select the “Save” button at the bottom.

For cpdavd:

1. Go to WHM => Service Configuration => cPanel Web Disk Configuration
2. Make sure that the “TLS/SSL Protocols” field contains “SSLv23:!SSLv2:!SSLv3”.
3. Select the “Save” button at the bottom.

For Dovecot:

1. Go to WHM => Service Configuration => Mailserver Configuration.
2. SSL Protocols should contain “!SSLv2 !SSLv3”. If it does not, replace the text in this field.
3. Go to the bottom of the page, and select the Save button to restart the service.

For Courier:

Courier has released a new version to mitigate this as of 10/22, until we have an opportunity to review, test, and publish the new version of Courier please switch to Dovecot for enhanced security.

For Exim:

1. Go to Home » Service Configuration » Exim Configuration Manager
2. Under Advanced Editor, look for ‘openssl_options’.
3. Make sure the field contains “+no_sslv2 +no_sslv3”.
4.Go to the bottom of the page, and select the Save button to restart the service.

 

For Lighttpd:

Lighttpd releases before 1.4.28 allow you to disable SSLv2 only.

If you are running at least 1.4.29, put the following lines in your configuration file:

ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"

How to verify the Poodle is disabled

You can use a website like http://poodlebleed.com/ for a web based check.

 

Manual check

To make sure services on your server are not accepting SSLv3 connections, you can run the openssl client on your server against the SSL ports. This command is run as follows:

openssl s_client -connect linuxwebhostingsupport.in:443 -ssl3

If it fails (which is what you want), you should see something like this at the top of the output:

3078821612:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1257:SSL alert number 40
3078821612:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: